Executive brief
Lumiverse is an AI chat application. A security flaw in how the application handles server configurations allows any logged-in user to execute arbitrary commands on the underlying server. This could lead to a complete takeover of the system, unauthorized access to sensitive data, and disruption of services.
Technical details
An argument injection vulnerability exists in the MCP server creation endpoint of Lumiverse. While the application validates the primary command against an allowlist of binaries (e.g., node, python3), it fails to validate the 'args' array passed to the child process. Attackers can use flags like '-e' or '-c' to execute inline code through these allowed binaries. The vulnerability is reachable by any authenticated user (requireAuth) and can be exploited over the network because the server binds to all interfaces and lacks robust host-header validation. This results in full OS-level code execution as the user running the Lumiverse process.
Affected products
- prolix-oc Lumiverse < 0.9.7
- npm lumiverse-backend <= 0.9.5
Timeline
- 2026-05-06: advisory: Original GitHub advisory published
- 2026-05-26: disclosed: CVE published to NVD